Re: SMTP problem.
On Tue, 23 Jul 2002 at 10:11:31 +0200, Lars Roland Kristiansen wrote:
> On Tue, 23 Jul 2002, Vineet Kumar wrote:
> [...]
> > This doesn't look particularly harmful, but if it is the "unknown" part
> > that is scaring you, try adding an entry for 192.168.2.1 in /etc/hosts.
> > Other than that, it just looks like that host is making an smtp
> > connection and then later disconnecting. This will happen each time it
> > relays a message through you, and is nothing to be alarmed about (unless
> > you don't intend to be accepting mail from this host, but as I
> > understood your setup, that's exactly what you intend to be doing).
>
> Well maby you are right it is only a littel strange that when it ralays a
> mail it says somthing like this.
>
> Jul 23 10:10:12 mail
> postfix/cleanup[7634]: 1B8CC43C024: message-id=<C093ADA63B306349A0FF08A6619DA67407BE38@travisexch.travis.com>
> Jul 23 10:10:12 mail
> postfix/qmgr[284]: 1B8CC43C024: from=<lroland@travis.com>, size=794,
> nrcpt=1 (queue active)
> Jul 23 10:10:12 mail postfix/smtpd[7633]: disconnect from
> unknown[192.168.2.1]
> Jul 23 10:10:13 mail
> postfix/smtp[7636]: 1B8CC43C024: to=<m00lrk@math.ku.dk>,
> relay=imf.math.ku.dk[130.225.103.32], delay=1, status=sent (250 2.0.0
> g6N89Qx26308 Message accepted for delivery)
>
> So if this is when it is duing somthing what is the rest and is there a
> way to track it down.
>
If I understand you correctly, you wonder what goes on when this host
connects and later disconnects _without_ sending anything.
You can have more details in log about this host's activity if you add to
main.cf:
debug_peer_list = 192.168.2.1
and possibly:
debug_peer_level = 2
(or maybe bigger number - I don't know what range of numbers is accepted
by this parameter).
Hope it helps
--
Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only
tomek@lodz.tpsa.pl http://www.lodz.tpsa.pl/ | ones and zeros.
--
To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: